Glossary
ARC
Mailing lists and forwarding services often change a message, which breaks its DKIM signature. ARC (Authenticated Received Chain) lets each of them record what passed before they touched it and seal that record. A receiver that trusts the forwarder can then accept the message despite the broken signature.
Authentication-Results
The server that delivered a message to your mailbox records its checks in an Authentication-Results header: SPF, DKIM, DMARC and sometimes ARC. The topmost one is from the final server. Ones further down may come from earlier servers, or from anyone, so we read only the topmost.
BCL
Microsoft rates bulk mail, like newsletters and marketing, by how often people complain about the sender. 0 is not bulk mail; higher numbers mean more complaints, and many organizations send mail rated 7 or higher to junk.
BIMI
BIMI (Brand Indicators for Message Identification) is a record at default._bimi.<your domain> that points to your logo, an SVG file in a strict format.
Inboxes show the logo only when your DMARC policy is at quarantine or reject for all your mail. Gmail and Apple Mail also want a mark certificate (a VMC or CMC) that proves the logo is yours. It's optional: BIMI makes your mail recognizable, but it doesn't change whether it's delivered.
See DMARC.
Blocklist
A blocklist (also called a DNSBL or RBL) is a list, published in DNS, of addresses or domains seen sending spam. Receivers look a sender up before accepting its mail.
A listing usually follows a hacked mailbox, a compromised website or a sudden burst of mail. Fix the cause first, then ask the list to remove you; each list has a removal page.
DKIM
DKIM (DomainKeys Identified Mail) lets a receiver check that a message really came from a service you authorized and wasn't changed on the way.
Your sending service signs each message. The matching public key is published in your DNS under a selector, at <selector>._domainkey.<your domain>. Each service you send through usually has its own key.
DKIM selector
A selector is the first part of a DKIM key's name: in google._domainkey.example.com the selector is google. Each service you send through picks its own, which is how one domain can have several keys at once.
We look for the selectors well-known services use. If yours uses a custom one, name it when you add a mail flow, so we can check it.
DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.<your domain>. It ties SPF and DKIM to the address people see in the From line, and tells receivers what to do when a message fails:
p=none: deliver it anyway, but send me reports.p=quarantine: treat it as suspicious, usually the spam folder.p=reject: refuse it.
Only quarantine and reject stop someone sending mail that pretends to be you. See Moving to p=reject safely.
DMARC reports (rua)
The rua= tag in your DMARC record is an address that receives aggregate reports: daily summaries, from providers such as Gmail and Microsoft, of the mail that used your domain and whether it passed.
Reports are how you find services you forgot about before you tighten your policy. They arrive as compressed XML, so most people send them to a reporting service rather than reading them by hand.
DNS
DNS (the Domain Name System) holds public records for your domain. Some point to your website, MX records say where your mail goes, and TXT records carry SPF, DKIM and DMARC.
You change them at your DNS host, which is often, but not always, the company you bought the domain from. Everything healthcheck.email checks comes from these public records.
DNSSEC
DNSSEC signs your domain's DNS records, so the servers that look them up can check that the answers are genuine and weren't tampered with on the way.
It's switched on at your DNS host and confirmed by a DS record at your registrar. Most DNS hosts offer it as a single setting.
MTA-STS
Mail between servers is usually encrypted, but an attacker on the network can strip the encryption off. MTA-STS (Mail Transfer Agent Strict Transport Security) publishes a small policy file at mta-sts.<your domain>, plus a TXT record at _mta-sts.<your domain>, telling senders to insist on encryption when they deliver to you.
Start in testing mode, and pair it with TLS-RPT to see failures before you enforce. In enforce mode, senders refuse to deliver unless each mail server the policy names offers STARTTLS with a valid certificate for its name, so we test that too when you run your own servers.
MX
MX (mail exchanger) records list the servers that accept mail for your domain, each with a priority. For example, Google Workspace and Microsoft 365 each give you the MX records to publish.
If your domain never receives mail, publish a null MX instead.
Nameserver
Your domain's nameservers are the servers that hold its DNS records and answer for them. Your registrar records which nameservers are in charge. Pointing them at a DNS host, such as Cloudflare, is what makes that host the place where you edit your records.
Two or more working nameservers, ideally at more than one location, keep your domain reachable.
Null MX
A null MX is a single MX record with priority 0 and the value .. It tells senders that the domain receives no mail, so they fail right away instead of retrying for days.
Use it on domains and subdomains that never receive email, along with an SPF record of v=spf1 -all.
Parked domain
A domain you own but don't use for email can still be used by someone else to send mail that pretends to be you. Locking it down takes three records:
- SPF:
v=spf1 -all - a null MX:
0 . - DMARC:
v=DMARC1; p=reject
Mark the domain as "Doesn't send email" on its Settings tab, and we check it for exactly this.
Received header
Every server that handles a message adds a Received header at the top, naming where it got the message from, who it is, and when. Read from the bottom up, they trace the message's route. The gaps between their times show where it waited.
Registrar
Your registrar, such as Cloudflare, GoDaddy or Namecheap, holds your domain's registration: who owns it, when it expires, and which nameservers answer for it.
Two things matter most. Keep the registration renewing, and turn on the registrar lock so the domain can't be moved away without your say-so.
Reverse DNS
Reverse DNS turns an address back into a name, through a PTR record that whoever runs the server sets, usually your host or ISP.
Receivers expect a sending server's reverse name to point back to the same address. When it doesn't, more of that server's mail lands in spam.
SCL
Microsoft 365 and Outlook.com give each message a spam confidence level. -1 means filtering was skipped because the sender is trusted, 0 and 1 mean not spam, 5 and 6 mean spam, and 9 means high confidence spam. It appears in the X-Forefront-Antispam-Report header.
Sender
A sender is any service your records allow to send mail as you: your mailbox provider, a newsletter tool, a billing system. We find them from your SPF includes and your DKIM keys, and name the ones we recognize.
On the Mail flows tab, tell us which ones are yours. One you say isn't yours, but that can still send, gets a fix that removes it.
SPF
SPF (Sender Policy Framework) is a TXT record on your domain that starts v=spf1. It lists who may send mail as you: includes for services, and IP addresses for your own servers. It ends with -all or ~all, which tells receivers what to do with everyone else.
A domain can have only one SPF record, and it may need at most 10 DNS lookups. Past that, receivers treat it as broken.
SPF include
include: lets a service maintain its own list of sending servers, which your SPF record then points to. Every service you send through usually asks you to add one.
Each include counts toward SPF's limit of 10 DNS lookups, including the lookups inside it, so remove the ones you no longer use.
STARTTLS
Mail servers talk to each other in plain text unless one asks to encrypt. STARTTLS is that request: the receiving server offers it, the sender asks, and the rest of the conversation is encrypted with the receiver's certificate. A server that doesn't offer it receives everything in the clear. With MTA-STS in enforce mode, senders also require the certificate to be valid for the server's name.
Subdomain
Services often send from a subdomain, such as mail. or news., so their mail is kept apart from yours. A subdomain can have its own SPF, DKIM, MX and DMARC records, and if it has no DMARC record of its own it follows your main record's sp= tag, or p= if there's no sp=.
On the Mail flows tab, mark the subdomains you don't use as not in use, and we'll check that they're locked down.
TLS-RPT
TLS-RPT (SMTP TLS Reporting) is a TXT record at _smtp._tls.<your domain> with a rua= address. Sending servers report there when they couldn't make a secure connection to your mail servers.
It's the safety net for MTA-STS: read it before you switch MTA-STS from testing to enforce.